PT-2014-5425 · Openstack+1 · Openstack Identity+1

Brant Knudson

·

CVE-2014-3621

·

Published

2014-10-02

·

Updated

2026-07-02

CVSS v2.0

4.0

Medium

VectorAV:N/AC:L/Au:S/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions prior to 2013.2.3 OpenStack Identity (Keystone) versions 2014.1 prior to 2014.1.2.1
Description The issue allows remote authenticated users to read sensitive configuration options via a crafted endpoint. This can be demonstrated by using "$(admin token)" in the "publicurl" endpoint field.
Recommendations For versions prior to 2013.2.3, update to version 2013.2.3 or later. For versions 2014.1 prior to 2014.1.2.1, update to version 2014.1.2.1 or later.

Exploit

Fix

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-3621
GHSA-8V8F-VC72-PMHC
PYSEC-2026-653
RHSA-2014:1688
RHSA-2014:1789
RHSA-2014:1790
USN-2406-1

Affected Products

Openstack Identity
Ubuntu